Description
A flaw was found in the internal WebAssembly (WASM) shim used by the Kuadrant operator. When generating the CEL predicate that determines whether Gateway-level authentication and rate limiting should run, the shim does not correctly escape values from HTTPRoute match fields. A user who can create or modify an HTTPRoute attached to a shared Gateway can provide a crafted path, header, or query match value that causes the predicate to skip those checks. The request is still forwarded to the route’s backend.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Red Hat Red Hat Connectivity Link 1.4
Default version status: affected
1791975888 to < *unaffected
Red Hat Red Hat Connectivity Link 1.5
Default version status: affected
1792512519 to < *unaffected
Red Hat Red Hat Connectivity Link 1
Default version status: unaffected
Red Hat Red Hat Connectivity Link 1
Default version status: unaffected
Red Hat Red Hat OpenShift AI (RHOAI)
Default version status: unaffected
Red Hat Red Hat OpenShift AI (RHOAI)
Default version status: unaffected
References
- https://access.redhat.com/errata/RHSA-2026:83531 ↗
- https://access.redhat.com/errata/RHSA-2026:88203 ↗
- https://access.redhat.com/security/cve/CVE-2026-108334 ↗
- https://bugzilla.redhat.com/show_bug.cgi?id=2548768 ↗
- https://github.com/Kuadrant/kuadrant-operator/commit/7e667dc216e6ad38feaeadb391da59aa0380057a ↗
- https://github.com/advisories/GHSA-fcw2-f6v9-6ffp ↗